Questions tagged [lets-encrypt]
Let's Encrypt is a certificate authority that provides free X.509 certificates for TLS encryption.
838
questions
242
votes
11
answers
556k
views
How to use Let's Encrypt DNS-01 challenge validation?
Let's Encrypt has announced they have:
Turned on support for the ACME DNS challenge
How do I make ./letsencrypt-auto generate a new certificate using DNS challenge domain validation?
EDIT
I mean: ...
163
votes
12
answers
332k
views
Best practices for setting a cron job for Let's Encrypt (Certbot) renewal?
Is this correct way to set cron for renewal of Let's Encrypt cert in Apache2 ?
I use Ubuntu 16.04.
@monthly letsencrypt renew && service apache2 reload
57
votes
2
answers
85k
views
Lets Encrypt with an nginx reverse proxy
Introduction
I have a dev server (currently running Ubuntu 14.04 LTS), which I have been using for a while now for hosting various development tools on different ports. Because the ports can be hard ...
40
votes
5
answers
79k
views
SSL & Ngnix: no "ssl_certificate" is defined in server listening on SSL port while SSL handshaking
I have managed to create my certificates with LE with not errors, I have also managed to redirect my traffic from port 80 to port 443. But when i reload my nginx server I am unable to access my ...
35
votes
5
answers
46k
views
how do I change the admin email for let's encrypt?
The email address used as the admin email when we started using let's encrypt needs to be modified (a former employee used his personal email address as the admin email and he is no longer with the ...
35
votes
5
answers
62k
views
Nginx disable .htaccess and hidden files but allow .well-known directory
I have a Nginx server, and disabled hidden files in the nginx_vhost.conf
## Disable .htaccess and other hidden files
location ~ /\. {
deny all;
access_log off;
...
26
votes
4
answers
87k
views
Certbot letsencrypt on different port than 443
I want to set up certbot for a webserver on a different port than 443.
I got the following error when running
certbot --apache -d <sub>.<domain>.<ext>
Failed authorization ...
23
votes
6
answers
23k
views
Client on Debian 9 erroneously reports expired certificate for letsencrypt-issued domain
If I try to access our HTTPS server that has certbot-issued certificate from debian 9, I get the following error:
# curl -v https://hu.dbpedia.org/
* Trying 195.111.2.82...
* TCP_NODELAY set
* ...
21
votes
2
answers
5k
views
How can Let's Encrypt verify the identity over insecure http?
I just started using Let's Encrypt. The http-01-challenge is simple enough:
Make a webserver respond to http://example.com
Ask Let's Encrypt for a challenge-file
Provide the file unter http://example....
19
votes
4
answers
77k
views
Nginx SSL_do_handshake() failed SSL: error:1417D18C:SSL
Today we've installed a SSL certificate (from letsencrypt) on our server which hosts a very busy website.
After a few hours we've noticed that we have some users are getting errors from nginx:
2018/...
19
votes
2
answers
12k
views
Redirect all requests to HTTPS, except for one subdirectory
I'm trying to move from self-signed certificates to Let's Encrypt certificates on my nginx webserver.
Currently, I redirect all requests to http/80 to https/443, which uses a self signed certificate ...
17
votes
1
answer
12k
views
How to setup coturn with letsencrypt
Giving this setup:
A Nginx is providing a .well-known folder listening on port 80/443 on the server to exchange the chellange for Letsencrypt. The certificate is created properly and can be used e.g. ...
17
votes
2
answers
4k
views
Why not validate self signed certificates through DNS-record instead of letsencrypt
I was just wondering. We use a lot of SSL certificates. Nowadays, we almost exclusively use letsencrypt (thanks!). The bottom line of these certificates is, that proof of ownership of the domain name(...
17
votes
1
answer
10k
views
Let's Encrypt certbot validation over HTTPS
Update: The original SNI challenge type has been disabled. There is a new more secure SNI challenge type with limited server support. SNI is not likely a suitable option for small sites.
I have ...
16
votes
5
answers
27k
views
Let's Encrypt SSL Certificate File Not Found Error, but still working
I'm running SSL Certificates from Let's Encrypt. I've got them installed on my Ubuntu machine running Apache. The setup works fine and I can launch the website, see the green padlock and even got an A+...
16
votes
1
answer
78k
views
Renew domains using certbot and using DNS challenge
I created several SSL certificates for several domains using the standalone method. I am only interested in the certificates, without server integration.
They are now for renewal.
So, I ran:
certbot ...
14
votes
1
answer
4k
views
Why does my Let's Encrypt certificate contain references to Cloudflare?
I own a website that uses a Let's Encrypt certificate. It's not behind Cloudflare, it's hosted at OVH and I'm accepting direct traffic from it.
Now, I set up an apache2 webserver and used certbot to ...
11
votes
3
answers
18k
views
Does order of lines matter in Nginx?
I have a server file like this
server {
listen 80;
server_name subdomain.example.com;
return 301 https://$server_name$request_uri;
location /.well-known/acme-challenge {
root /var/www/...
10
votes
1
answer
5k
views
A+ rating still unsecure by Google Chrome's opinion
I am provisioning my server on DigitalOcean, and although I am getting an A+ rating from ssllabs,
https://www.ssllabs.com/ssltest/analyze.html?d=zandu.biz
when I connect to my site, https://www....
10
votes
3
answers
10k
views
Let's encrypt: Remove only one hostname from certificate
I have the following certificate:
# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Found the following certs:
Certificate Name: domain.example
Domains: domain....
10
votes
1
answer
2k
views
Do SSL Certs containing two wildcards work (esp. on Let's Encrypt)? [duplicate]
I want to include two wildcards in an SSL cert (will be) signed by Let's Encrypt: *.*.thost3.de. Will this cert match any hostnames matching that rule (e.g. example.example.thost3.de, hello.world....
10
votes
1
answer
10k
views
Trying to get 100% in ssllabs.com key exchange
I wanted to know what steps are needed to get 100% on every category in ssllabs.com. I am aware that this could lead to problems in older systems, but I dont care.
My letsencrypt.org certificate ...
10
votes
1
answer
8k
views
RabbitMQ with a LetsEncrypt certificate
I have been trying to install my LetsEncrypt generated certificates into my rabbitmq server but have had no luck.
To test things out with out having to fight permission issues I have copied the pem ...
9
votes
3
answers
34k
views
How can I get a Let's Encrypt certificate for a non-public facing server?
I have a private Apache server, reachable only from my LAN on port 443, with a StartSSL certificate.
Since Firefox 51 was released, I cannot connect to it any longer as the StartSSL root certificate ...
9
votes
3
answers
53k
views
How do I specify a port other than 80 when adding SSL certificate using Certbot?
I have a server which runs 2 different web servers (Apache and Nginx). The Apache server takes care of all the traffic directed to Wordpress sites whereas the Nginx server serves my Python API and ...
8
votes
10
answers
23k
views
Using Lets Encrypt certificates with openLDAP
I've been running an openLDAP server for several months now and we use it to authenticate for a number of applications. A previous staff member set up the server and it doesn't seem to be a standard ...
8
votes
4
answers
15k
views
Lets Encrypt OpenVPN AS
I've got an OpenVPN AS running and I am trying to setup SSL certs (running ubuntu) from letsencrypt.
I've managed to get my certificates from letsencrypt (using letsencrypt standalone) and I was ...
8
votes
2
answers
20k
views
nginx "ERR_TOO_MANY_REDIRECTS" after add ssl
After i add Let's Encrypt certificate to my website with CertBot
i get ERR_TOO_MANY_REDIRECTS when i try to visit the domain of my website.
some info :
-mywebsite build with django, nginx and ...
8
votes
3
answers
16k
views
NGINX redirect everything except letsencrypt to https
I have a simple config, redirect everything except letsencrypt requests to https, and then have my virtual hosts only on https..
Currently all my requests are redirected to https, and then a 404 for ...
8
votes
2
answers
3k
views
Wildcard SSL with LetsEncrypt gives error
I want to create wildcard SSL for my website via LetsEncrypt. I followed the instruction and after running Certbot, it gives me a DNS challenge and says:
Please deploy a DNS TXT record under the name
...
8
votes
2
answers
2k
views
Letsencrypt - do I need to keep ".well-known" accessible for certificate renewal?
I created a certificate for my Apache 2.4 server. To validate my server letsencrypt created the folder .well-known and accessed it.
Do I need to keep this folder accessible (for certificate renewal) ...
8
votes
1
answer
1k
views
Use LetsEncrypt certs with Neo4j
How can one use the certificate files generated by LetsEncrypt together with a Neo4j instance? The files generated by LetsEncrypt are:
cert.pem
chain.pem
fullchain.pem
privkey.pem
I've tried ...
8
votes
1
answer
9k
views
Redirect everything but .well-known in NGINX (Let's Encrypt)
I want to get a certificate via the letsencrypt.sh so I have to provide a challenge on HTTP.
Already I use NGINX to forward to SSL (served on a nodejs server). Now I want to still redirect everything ...
8
votes
2
answers
3k
views
Using Let's Encrypt inside Docker's official Wordpress container
I'm trying to get Let's Encrypt inside the official Docker Wordpress container.
Setup the environment
$ cat docker-compose.yml
wordpress:
hostname: some.fqdn.com
image: wordpress
links:
- ...
8
votes
1
answer
1k
views
Utilizing SSL on Multi-domain, Autoscaling Elastic Beanstalk Setup
We are creating a Content Management System for our company. It is important that this CMS support dynamic domain names on a dynamic number of servers. After many hours of research we felt that Amazon'...
7
votes
1
answer
25k
views
Letsencrypt for all subdomains *.example.com [duplicate]
I'd like to obtain one certificate working for all my subdomains *.example.com.
This works:
certbot-auto certonly --webroot --webroot-path /home/www/example/ --domain example.com
...
7
votes
1
answer
1k
views
Explain Certbot's HTTPS redirect configuration
Can someone explain why Certbot is using the following redirect configuration
server {
if ($host = example.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
...
7
votes
5
answers
3k
views
How do I conditionally set the SSLCertificateFile when the file exists?
I am using Let's Encrypt (certonly) to generate SSL certificates for several websites hosted on an Apache server. The file location of these certificates is determinate before they are created, so I ...
7
votes
1
answer
14k
views
Renew letsencrypt certificate on Apache httpd
I'm using certbot --webroot plugin and certbot renew to renew the certificate, which does work, but it looks like httpd is caching the certificate and does not "see" that it's been updated.
Is there ...
7
votes
3
answers
4k
views
configure CouchDB with Lets Encrypt SSL certificate
What i would like to do:
Now I'm using a self signed SSL certificate which works wonderful. But I would like to replace them with an official one of lets encrypt.
What i have (self signed certificate)...
7
votes
1
answer
7k
views
How to have apache handle .well-known/acme-challenge and still have / passed to wsgi
In order to support automatic LetsEncrypt certificate renewal certbot uses the --apache handler.
e.g.
certbot renew --apache
This handler installs a temporary VirtualHost for */.well-known/acme-...
7
votes
1
answer
7k
views
nginx https www redirect to non-www using let's encrypt certbot
Hi this must be a basic question but I haven't seen an answer with cerbot considerations (if there are any considerations). How do I get https www to redirect to non-www instead of timing out?
The ...
7
votes
1
answer
16k
views
Adding a subdomain on Google Domains
I'm trying to create a TXT DNS record with name _acme-challenge.www on Google Domains to allow me to validate my DNS (i.e. via _acme-challenge.www.example.com). I've already validated the domain ...
7
votes
3
answers
8k
views
Let's Encrypt -- "DNS ... query timed out looking up CAA for ..."
I have been using Let's Encrypt on a few domains for a couple of months now, and it generally has been working. I was going through renewing the certs, and for one of the domains I get the following ...
6
votes
3
answers
18k
views
How to grant access to "/.well-known" directory on SVN server (Apache 2.2)
I cannot figure out how to disable authentication for the .well-known directory.
Things behave as expected when I remove the SVN specific directives (DAV, SVNPath, AuthzSVNAccessFile).
<...
6
votes
1
answer
2k
views
Why does certbot suddenly fall back to http-01 challenge instead of tls-sni-01 (https)?
I have a well-tested bash script that was running fine until a few weeks ago.
It seems that certbot challenge defaults now to http instead of https. I can't figure out the reason.
echo 'rsa-key-size =...
6
votes
2
answers
5k
views
Use Letsencrypt certificates for Postgresql
I have successfully configured Letsencrypt for my NGINX webserver on Debian 8 Jessie.
Now I have installed Postgresql 9.4 and want to use the LE certificates (in /etc/letsencrypt/live/mydomain/com/......
6
votes
1
answer
2k
views
SSL alert number 113
We're seeing some errors in the past few days similar to this one, in our nginx error logs:
/var/log/nginx/error.log.2.gz:2017/01/30 16:11:46 [crit] 13114#13114: *139338 SSL_do_handshake() failed (SSL:...
6
votes
0
answers
11k
views
SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client:
A few months ago I started getting complaints from dozens of users about getting errors when connecting to my site. When I look into the error.log of nginx I see daily SSL errors:
I have no idea what ...
6
votes
0
answers
893
views
Error creating Letsencrypt certificate from Azure web site extension
Our web app running on Azure has the Azure Let's Encrypt 0.9.6 extension installed.
Launching the extension (https://********-website-stage.scm.azurewebsites.net/letsencrypt/) is no problem and we get ...